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We show that private shared reference frames can be used to perform private quantum and 
private classical communication over a public quantum channel. Such frames constitute a novel 
type of private shared correlation (distinct from private classical keys or shared entanglement) 
useful for cryptography. We present optimally efficient schemes for private quantum and classical 
communication given a finite number of qubits transmitted over an insecure channel and given a 
private shared Cartesian frame and/or a private shared reference ordering of the qubits. We show 
that in this context, it is useful to introduce the concept of a decoherence-full subsystem, wherein 
every state is mapped to the completely mixed state under the action of the decoherence. 
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I. INTRODUCTION 

It is well known that a private classical key can be used 
for secure classical communication on a public channel 
using the Vernam cipher (one-time pad) 0] ■ Specifically, 
an n-bit string M , the plain-text, can be added bit-wise 
(modulo 2) to a random n-bit string K , the key, to yield 
an ?7-bit string C = M ® K, the cipher-text. Someone 
who possesses the key can retrieve the plain-text from 
the cipher-text via M = C ® K; however, for someone 
who does not possess the key, C is completely random 
and contains no information about M . The cipher-text 
can therefore be transmitted over a public channel with 
complete security. 

In quantum cryptography^ , quantum rather than clas- 
sical systems are used for the transmission (i.e., a quan- 
tum cipher-text) , allowing for one or both of the following 
innovations: (i) the key is quantum, corresponding to 
entanglement between the cooperating parties; (ii) the 
plain-text is quantum, namely, a quantum state drawn 
from a set of states not all of which are orthogonal. 

A classical plain-text can be encrypted with a quantum 
key (specifically, 2 c-bits can be encrypted using 1 e-bit 
of entanglement) by making use of a dense coding pro- 
tocol 0- A quantum plain-text can be encrypted with 
a classical key (specifically, 1 qubit with 2 c-bits) by a 
scheme known as a private quantum channel 0| . Finally, 
a quantum plain-text may be encrypted with a quantum 
key (1 qubit with 2 e-bits) using the quantum Vernam 
cipher [J ^. Note that when the plain-text is quantum. 



it has been shown that it is possible, by monitoring for 
eavesdropping, to recycle the key for future use |j, 0]. 
What all these schemes have in common is that they 
make use of private shared correlations to encode infor- 
mation. 

In this paper, we wish to consider the applications to 
cryptography of a different sort of private shared corre- 
lation, namely, a private shared reference frame (SRF). 
Two parties are said to share a reference frame (RF) for 
some degree of freedom when there exists an isomorphism 
between their experimental operations involving this de- 
gree of freedom Q. For example, Alice and Bob are said 
to share a Cartesian frame, defining an orthogonal tri- 
hedron of spatial orientations, when they can implement 
the following task. Alice sends to Bob a spin-1/2 parti- 
cle aligned along a direction n with respect to her local 
Cartesian frame. She then communicates a classical de- 
scription of this direction to Bob (for instance, its Euler 
angles), and Bob must orient his Stcrn-Gerlach magnets 
in such a way that the spin-1/2 particle emerges in the 
upper path with certainty. If Alice and Bob can orient 
themselves with respect to the fixed stars, then they will 
be able to implement the task above, and thus will be 
said to share a Cartesian frame. An alternative method 
for sharing a Cartesian frame is for Alice and Bob to 
possess, within their respective labs, sets of gyroscopes 
that were aligned at a time prior to Alice and Bob having 
been separated. 

Two parties are said to possess a private SRF for some 
degree of freedom if the experimental operations of all 
other parties fail to be isomorphic to theirs in the sense 
described above. Although it is difficult to imagine how 
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to implement a teleportation protocol for the qubit wherein the 
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a Cartesian frame defined by the fixed stars might be 
made private, it is clear that if the Cartesian frame is de- 
fined by a set of gyroscopes, privacy amounts to no other 
party having gyroscopes that are known to be ahgned 
with those of Alice and Bob. 

Unlike cither classical or quantum information, which 
can be communicated using any degree of freedom one 
chooses, reference frames require the transmission of a 
system with a very specific degree of freedom Two 
clocks can only be synchronized by the transmission of 
physical systems that carry timing information, such as 
photons, and two Cartesian frames can only be aligned 
by the transmission of physical systems that carry some 
directional information, such as spin-1/2 particles. The 
optimal way of establishing a SRF given different sorts 
of information carriers has been the subject of many 
recent investigations H H IH 111 111- Recog- 
nizing the distinction between SRFs and either clas- 
sical key or quantum entanglement has also been im- 
portant in identifying the resources that are required 
for continuous variable teleportation in quantum op- 
tics [UllllllllllllllliSllll. There have also 
been several investigations into the impact of lacking 
the resource of a SRF for various tasks. These tasks 
have included communicating classical and quantum in- 
formation , accessing entanglement |22l | , discriminating 
states in a data hiding protocol p^ . and implementing 
successful cheating strategies in two-party cryptographic 
protocols such as bit commitment |2J| . 

In the present work, we further clarify the nature of 
SRFs as a resource, by determining the extent to which 
private SRFs are a resource for cryptography. 

To illustrate the general idea, consider the case where 
Alice and Bob share a private Cartesian frame. They 
can then achieve some private classical communication 
as follows: Alice transmits to Bob an orientable physical 
system (e.g., a pencil or a gyroscope) after encoding her 
message into the relative orientation between this system 
and her local reference frame (for instance, by turning her 
bit string into a set of Euler angles). Bob can decrypt 
the message by measuring the relative orientation be- 
tween this system and his local reference frame. Because 
an eavesdropper (Eve) does not have a reference frame 
correlated with theirs, she cannot infer any information 
about the message from the transmission. 

In classical mechanics, it is in principle possible to dis- 
criminate among a continuum of different states of a finite 
system. In this setting, a private shared reference frame 
together with the transmission of a finite system would 
allow for the private communication of an arbitrarily long 
message. However, in quantum mechanics, finite systems 
support only a finite number of distinguishable states, so 
the question of the private communication capacity of a 
private SRF given finite uses of a channel is non-trivial. 
In addition, we can investigate the possibility of private 
quantum communication. 

This paper is structured as follows. In Sec. ^ we de- 
scribe how two parties who share a private Cartesian 



frame can privately communicate quantum or classical 
information using one, two, or three transmitted spin-1/2 
particles. These examples illustrate the central concepts 
of the paper. In Sec. IIIII we present optimally efficient 
private quantum communication schemes for arbitrary 
numbers of transmitted qubits. It is also here that we 
properly introduce the concept of a decoherence-fuU sub- 
system. In Sec. II VI we present optimally efficient schemes 
for private classical communication for large numbers of 
transmitted qubits. Finally, in Sec. [3 we conclude with 
a discussion of the significance of these results as well as 
some directions for future research. 



II. SOME SIMPLE EXAMPLES 

Consider a communication scenario consisting of two 
parties, a sender (Alice) and a receiver (Bob), who have 
access to an insecure noiseless quantum channel and who 
possess a private SRF. Continuing with our example, we 
consider spin systems that possess only rotational degrees 
of freedom, in which case all local experimental opera- 
tions, such as the placement of a Stern-Gerlach magnet, 
are performed relative to a local Cartesian frame which 
is private. 

A. One transmitted qubit 

Consider the transmission of a single qubit from Alice 
to Bob. As they possess an isomorphism between their 
experimental operations. Bob can use the outcomes of his 
measurements to infer information about Alice's prepa- 
ration. For example, they can communicate a classical 
bit by Alice preparing one of an orthogonal pair of states 
(|0) or |1)) and Bob performing the corresponding pro- 
jective measurement which reveals the preparation with 
certainty. 

On the other hand, an eavesdropper (Eve) who does 
not share Alice and Bob's private SRF cannot correlate 
the outcomes of her measurements with Alice's prepa- 
rations. To represent the state of the transmitted qubit. 
Eve must average over all rotations fl G SU(2) that could 
describe the relation between her local RF and theirs. 
Thus, Eve would represent the state of the qubit relative 
to her uncorrelated reference frame as 

Si{p) = J dnR{n)pR'<{n) = i/, (i) 

where R{Q) is the spin-1/2 unitary representation of € 
SU(2). dil is the SU(2)-invariant measure'^ and / is the 
identity. Thus, as a result of being uncorrelated with the 
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private SRF. Eve cannot acquire any information about 
Alice's preparation. Using this single qubit and their 
private SRF, Alice and Bob can privately communicate 
one logical qubit, and thus also one logical classical bit. 

B. Two transmitted qubits: Decoherence full 
subspaces 

If multiple qubits are transmitted, it is possible for Eve 
to acquire some information about the preparation even 
without access to the private SRF by performing relative 
measurements on the qubits |25j |. Consider the example 
of two transmitted qubits, and suppose that Alice assigns 
the state p to the pair. Eve does not know how her 
RF is oriented relative to Alice's, but she knows that 
both qubits were prepared relative to the same RF. Thus, 
Eve's description of the pair is obtained from Alice's by 
averaging over all rotations G SU(2), but with the same 
rotation applied to each qubit. Eve therefore describes 
the pair by the Werner state 

£2{p) = J dr!i?(r!)®2pi?t(f^)®2 

= Pi(in,=i)+Pon,=o, (2) 

where 

p,=Tr(pn,), (3) 

and where R{n)'^'^ = R{n) (g) R{n) is the (reducible) col- 
lective representation of SU(2) on two qubits, and Ilj is 
the projector onto the subspacc of total angular momen- 
tum j. It is clear that Eve has some probability of distin- 
guishing states that differ in the weight they assign to the 
symmetric (j = 1) and antisymmetric (j = 0) subspaces. 
Moreover, she can distinguish perfectly between the anti- 
symmetric state and a state which lies in the symmetric 
subspace. In other words, despite not sharing the RF, 
Eve can still measure the magnitude of the total angu- 
lar momentum operator and thus acquire information 
about the preparation. 

Eq. Q implies that the two-qubit superopcrator £2 is 
completely depolarizing on the three-dimensional sym- 
metric subspace. In contrast to decoherence-frce sub- 
spaces [2^ used in quantum computing, the effect of the 
map £2 on this subspace is irreversible: the superopcr- 
ator takes any state on this subspace to a fixed state, 
namely, the completely mixed state on this subspace. In 
Section IIIII we will define subspaces with this property 
to be decoherence-full subspaces'^ . 

By encoding in a decohcrence-fuU subspace, Alice can 
achieve private quantum communication. For instance. 



Note that the term "decoherence" has many connotations in the 
hterature. Here, we shall take the term to be synonymous with 
"noise", where this noise may arise from ignorance rather than 
a coupling to the environment. 



Alice can encode a logical qutrit^ state into a state ps of 
two qubits that has support entirely within the symmet- 
ric subspace. Bob, sharing the private RF, can recover 
this qutrit with perfect fidelity. However, Eve identifies 
all such qutrit states with £2{ps) = ^^j=i, the com- 
pletely mixed state on the j — 1 subspace, and therefore 
cannot infer anything about ps- Thus, using this scheme, 
a private qutrit can be transmitted from Alice to Bob us- 
ing two qubits. 

Now consider how many classical bits of information 
Alice can transmit privately to Bob. An obvious scheme 
is for her to encode a classical trit as three orthogonal 
states within the symmetric subspace. (For example, us- 
ing the three symmetric Bell states \tp~^), and |(/)^).) 
However, this is not the optimally efficient scheme. Sup- 
pose instead that Alice encodes two classical bits as the 
four orthogonal states 

N) = ^|V'-) + ^|n.)|n,) , z = l,...,4, (4) 

where \^~) is the singlet state and the jrii) jrii) arc four 
states in the symmetric subspacc with both spins pointed 
in the same direction, with the four directions forming a 
tetrahedron, and with the phases chosen to ensure or- 
thogonality of the \i) (see [2al)- It is easy to verify that 

£2{\^){^\)^\I, (5) 

the completely mixed state on the two qubit Hilbert 
space. Thus, these four states are completely distinguish- 
able by Bob but completely indistinguishable by Eve. By 
Holevo's theorem, two classical bits is the maximum one 
could possibly communicate by the transmission of two 
qubits, so this scheme is optimally efficient. 



C. Three transmitted qubits: Decoherence-full 
subsystems 

Consider the transmission of three qubits from Alice to 
Bob. If Alice prepares these qubits in the state p, then 
Eve, who lacks the SRF, assigns the state 

£3(p) = Jdn i?(r!)®3pi?t(n)®3 _ (6) 

With three qubits, the four-dimensional symmetric sub- 
space consisting of states with total angular momentum 
j = 3/2 is a decoherence-full subspace: all states on this 
subspace are mapped by £3 to the completely mixed state 
on this subspace. 

The four-dimensional subspacc consisting of 

states with total angular momentum j = 1/2 has a more 
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complex structure. This subspace can be given a tensor 
product structure (TPS) ^ as 

H,=i/2 =Hij®Hp, (7) 

where Hjj is a two-dimensional Hilbert space that carries 
the j = 1/2 irreducible representation of SU(2), and Hp 
is a two-dimensional Hilbert space that carries the trivial 
representation of SU(2). This TPS does not correspond 
to the TPS obtained by combining multiple qubits: it 
is virtual j^Of. We refer to these two factor spaces as 
subsystems, a concept we will define more precisely in 
Section [nil For the moment, we consider how the super- 
operator £3 acts on states in terms of these subsystems. 
Because SU(2) acts irreducibly on Hp and trivially on 
Hp, the superoperator £3 restricted to states on 
can be expressed as 

f3(p, = l/2) = {'Dr®Ip){Pj^i/2) , (8) 

where Pp is the completely depolarizing superoperator 
on Hp and Tp is the identity operation on Hp. Thus, 
£3 takes any product state of the form pn® ap to the 
state \Ir ®(jp. In fact, Vpi^Xp maps any state Pj=i/2 
on Hp (g) Hp to the product state iJp ® Trp(pj=i/2), 
where Trp is the partial trace over the subsystem Hp, 
thus removing all correlations between the subsystems. 
We call the subsystem Hp a decoherence-full subsystem. 

We can now express the action of the superoperator £3 
on an arbitrary state p of three qubits as 

Ssip) ^ P3/2il^j=3/2) + PiM^Ir® PP) . (9) 

where 

=Tr(pn,), (10) 

^^ = ^Trp(n,^i/2pn,=i/2). (11) 

Consider the following two options that Alice has for pri- 
vately communicating quantum states to Bob using their 
private SRF: 1) she can encode quantum states into the 
decohercncc-full j = 3/2 subspace (allowing private com- 
munication of two qubits); 2) she can encode a qubit state 
p into a product state p ® oq in the j = 1/2 subspace, 
where ctq is some fixed state on Hp. (Using the latter 
scheme, all states are represented by Eve as ^/p(8'cro, who 
thus cannot obtain any information about p.) Clearly, 
using the j = 3/2 subspace provides a superior capac- 
ity, and we will prove in Section 11111 that this scheme 
is optimally efficient for three qubits. Note however 
that for greater numbers of qubits, the decoherence-full 
subsystems typically have greater dimensionality than 
the decoherence-full subspaces, and schemes that encode 
within them are necessary to achieve optimal efficiency. 

For private classical communication, the question of 
optimal efficiency is much more complex. One scheme 
would be for Alice to encode two c-bits into four orthog- 
onal states within the j = 3/2 decoherence-full subspace. 
Using the j = 1/2 subspace, it might seem that the best 



Alice can do is to encode a single c-bit into two orthog- 
onal states in the decoherence-full subsystem Hp; how- 
ever, there is a better scheme using this subspace. If Alice 
encodes two c-bits into four orthogonal maximally entan- 
gled states on the virtual TPS Hp ® Hp, these states are 
completely distinguishable by Bob but, using Eq. ©, all 
map to the same state ^/p ® ^Ip on Hp (E) Hp under 
£3 and thus arc completely indistinguishable from Eve's 
perspective. Thus, using the j = 1/2 subspace, Alice can 
privately transmit two c-bits to Bob, the same number 
as can be achieved using the j = 3/2 subspace. 

It turns out that the optimally efficient scheme for 
private classical communication uses both the j = 3/2 
and j = 1/2 subspaces. Let |j=3/2,^), p = 1,...,4 
be four orthogonal states on the j = 3/2 subspace, and 
let 1^=1/2, p), p = 1, . . . , 4 be four maximally entangled 
states (as described above) on the j ^ 1/2 subspace. De- 
fine the eight orthogonal states 

\b,p) = (b=3/2, A^) + (-l)''b = l/2, P)) , (12) 

where b = 1,2 and p = 1,...,4. Alice can encode 3 
c-bits into these eight states, which are completely dis- 
tinguishable by Bob. It is easily shown using Eq. 
that the decohering superoperator £3 maps all of these 
states to the completely mixed state on the total Hilbert 
space; thus, these states arc completely indistinguishable 
by Eve. This scheme is optimally efficient for private 
classical communication because, by Holevo's theorem, 
three c-bits is the maximum amount of classical com- 
munication that can be achieved with three transmitted 
qubits. 

So we see that the optimal efficiency for private clas- 
sical communication (three c-bits) is greater than that 
for private quantum communication (two qubits) if we 
directly compare c-bits to qubits. This result generalizes 
in the case of TV transmitted qubits. Note, however, that 
the ratio of private capacity to public capacity decreases 
with increasing N. 

The examples presented in this section illustrate the 
central concepts of this paper. We now turn to the gen- 
eral case. 



III. PRIVATE QUANTUM COMMUNICATION 

A. General schemes for private quantum 
communication 

We begin the general discussion by defining private 
quantum communication schemes (using public quantum 
channels and without classical "broadcast" channels) as 
in (3||, and deriving some general results for such schemes. 

Any time Alice and Bob have some private shared cor- 
relation, that is, one to which Eve does not have access, 
Eve's description of the systems transmitted along the 
channel is related to Alice's description by a decohering 
superoperator, denoted by £. 
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Definition: A private quantum communication 
scheme for E . Such a scheme consists of an encoding C, 
mapping message states in a logical Hilbert space Hl to 
encoded states on the Hilbert space H of the transmitted 
system, such that (i) the map C is invertible by Bob (who 
possesses the private shared correlations), allowing him 
to decode and recover states on with perfect fidelity, 
and (ii) the encoding satisfies 

£[CigL)]=Po, VpiOnHL, (13) 

where po is some fixed state on H. This latter property 
ensures that all encoded states are completely indistin- 
guishable from Eve's perspective, so that she cannot ac- 
quire any information about ql through measurements 
on£[C{gL)]. 

This definition is equivalent to a "private quantum 
channel" defined in Q. We define an optimally efficient 
private quantum communication scheme as one for which 
Hl is of maximal dimension. 

The invertibility of the encoding C by Bob places strin- 
gent conditions on the image of the logical Hilbert space 
Ml in H. In order to ensure this invertibility, one method 
of encoding is to choose C such that maps isomorphi- 
cally to a subspace H' C H of equal dimension. However, 
the most general method of encoding involves using an- 
cilla systems Let H" c H be a subspace that pos- 
sesses a tensor product structure H" = ® with 
Ma isomorphic to Hl. The Hilbert space Ha is referred 
to as a subsystem of H. An encoding C that maps any 
state ql on Hi to the state Ql ^ ctq on H^ <E) H^ for 
some fixed ancillary state uo on Mb is the most general 
encoding that is invertible. In this case, we say that H^ 
is encoded by C into the subsystem H^ . 

In order for encoded states in a subsystem to be com- 
pletely indistinguishable by Eve, the supcroperator £ 
must map them all to the same density matrix po on 
H. Wc give a name to such subsystems. 

Definition: Completely private subystems. For all ql 
on Ma, and for a fixed ctq on H^, if 

£[ql ® CTo) = Po , (14) 

where po is independent of ql , then the subsystem H^ is 
said to be completely private with respect to £. 

Every completely private subsystem with respect to 
a supcroperator £ allows for the definition of a private 
quantum communication scheme. The scheme simply 
encodes a logical Hilbert space isomorphically into this 
completely private subsystem. 

B. Decoherence-full subsystems 

In the following, we highlight a particular class of com- 
pletely private subsystems, namely, those for which ev- 
ery state defined on the subsystem is mapped by £ to 
the completely mixed state on the subsystem. In con- 
trast to the decoherence-free (D-free) or noiseless subsys- 
tems [31II32I employed in quantum computing, the effect 



of the decoherence on these subsystems is maximal, and 
so we dub these decoherence-full (D-fuU) subsystems. 

Definition: Decoherence-full subspaces/subsy stems. 
Consider a supcroperator £ that acts on density oper- 
ators on a Hilbert space H. A decoherence-full (D-full) 
subspace is a subspace H' C H such that the superoper- 
ator £ maps every density operator on H' to the com- 
pletely mixed density operator on H'. Consider a sub- 
space H" C H that possesses a tensor product structure 
H" ^Ma^Mb such that 

£{pA®PB) = i2^A®p'B, (15) 

where -]^Ia is the completely mixed state on H^ and 
p'g is independent of pA- We define such a H^ to be a 
decoherence-full (D-full) subsystem. If, in addition, p'^ = 
Pb for all pb, so that H^ is decoherence-free, that is, if 

£{PA® Pb) = ^Ia® PB , (16) 

for all PA ® Pb, then we define the product H^ ® Mb 
to be a D-full/D-free subsystem pair. Restricted to a D- 
fuU/D-frec subsystem pair, the supcroperator £ has the 
decomposition £ab = Da^^b with respect to this TPS, 
where Da is the completely depolarizing supcroperator 
on Ma , and Tb acts trivially on Hb . 

Note that a D-full subspace is a special case of a D-full 
subsystem for which H^ is one-dimensional. 

In the following, we will show that D-full subsystems 
define optimally efficient schemes for private quantum 
communication for the class of superoperators describing 
Eve's ignorance of an SRF. 

C. Group-averaging superoperators 

The results so far in this section have not made any 
assumptions about the sort of private shared correlation 
that Alice and Bob are using to encode their informa- 
tion. We now focus on the case of a private SRF. This 
restriction will allow for a simple decomposition of the 
total Hilbert space into D-full/D-frec subsystem pairs. 

Note first that every reference frame is associated with 
a symmetry group. For instance, a Cartesian frame is as- 
sociated with the group of rotations SU(2), a clock (phase 
reference) is associated with U(l), and a reference order- 
ing (which we shall consider in section lTlI F|l is associated 
with the symmetric group Sn ^- If Eve does not share 
Alice and Bob's RF, then she is ignorant of which element 
of the group describes the relation between her local RF 
and that of Alice and Bob. The unital supcroperator £ 
describing Eve's ignorance is therefore an average over 



^ However, note that a partial reference frame is associated with 
a factor space of a group; e.g., a reference direction is associated 
with the factor space SU(2)/U(1), where U(l) is the symmetry 
group of the direction under rotations. 
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the collective representation T of a group G acting on H. 
If G is a Lie group, then 8 acts on states p on H as 

8{p)^ [ dv{g)Tig)pTHg) , (17) 
Jg 

where dv is the group-invariant measure on G. For finite 
groups, the superoperator acts as 

^^P^ = ditG^^^^'^P^^^^'^' ^^^^ 

i 

where dim G is the dimension of G. In the following, 
we use the notation of Lie groups; all results are equally 
applicable to finite groups. 

If T acts irreducibly on H, then £ is completely depo- 
larizing (by Schur's lemma). However, if T is reducible, 
then we can use the irreducible representations (irrcps) 
Tj of G to construct projection operators 

n.cx / dv{g)T,{g-')T{g), (19) 
Jg 

up to a constant of proportionality. These projection 
operators decompose the Hilbert space H into a direct 
sum as 

H = . (20) 

i 

In general, each irrep occurs multiple times; we can fac- 
tor each subspace Hj into a tensor product of subspaces 
Hjvi ® HjB as follows. Each subsystem Rja is the carrier 
space for the irreducible representation Tj of G, and each 
corresponding subsystem Mjb carries the trivial represen- 
tation of G and has dimension equal to the multiplicity 
of Tj. (See [13 •) The total Hilbert space decomposes as 

H = 0Mj,i®HjB. (21) 

3 

Each subsystem MjA is D-fuU, and each subsystem Mjs 
is D-frce. Thus, each MjA ^ Mjs form a D-fuU/D-free 
subsystem pair. The action of the superoperator £ can 
be expressed in terms of this decomposition as 

£{p) - ^(P,^ ® X,s)(H,pn,) , (22) 
i 

where DjA is the completely depolarizing superoperator 
on each H^vi, and Tjs acts trivially on each Mjs- 

It should be noted that the MjA arc the only D-fuU 
subsystems. This claim follows from the fact that if a 
subsystem is D-full then the representation T of G must 
act irreducibly when restricted to it, and the fact that the 
MjA are the only subsystems on which the representation 
T of G acts irreducibly. The inference from a subsystem 
being D-full to having T act irreducibly upon it is per- 
haps not obvious, so we give a short proof by contradic- 
tion. Suppose Ma is a D-full subsystem on which T acts 



reducibly. It then follows that there exists an invariant 
subspace C Ma, meaning that for any g G G, T{g) 
maps onto itself. Thus, the action of £ of Eq. l(T7|) 
must take a state in to a state with support entirely 
on H'^, which cannot be the completely mixed state on 
Ma- It follows that Ma is not a D-full subsystem, which 
contradicts our initial assumption. 



D. Optimally efficient private quantum 
communication schemes 

We can now prove our central result for private quan- 
tum communication schemes: 

Theorem 1: An optimally efficient private quantum 
communication scheme for a group-averaging decohering 
superoperator £ is given by encoding into the largest D- 
fuU subsystem for £. 

Proof: It is clear that every private quantum commu- 
nication scheme encodes into a completely private subsys- 
tem. It suffices therefore to show that the dimension of 
any completely private subsystem for a group-averaging 
decohering superoperator £ is less than or equal to the 
dimension of the largest D-full subsystem for £. 

Let EIb be a completely private subsystem for a group- 
averaging decohering superoperator £ of the form given 
in Eq. (|17|l . and let be the complementary subsystem 
such that Me®e M'^ C H (where denotes the tensor 
product structure with respect to these subsystems). 

The condition for H^; to be completely private is 

£{\i^E){tpE\®E(To) = PO, y\lpE)eME, (23) 

for some fixed state uo on H^, where po is a density 
operator on H that is independent of IV'-e)- Because uo 
is arbitrary, we can choose it to be a pure state cro = 
|0o)(0o| for |0o) G H^;, which simplifies our proof. 

Using the expression H22|) for the action of £ and pro- 
jecting both sides of condition (|23|l onto an irrep j gives 

{VjA®^,Bm,E){^jE\) = PO, , (24) 

where we have defined \'ipjE) = ^j{\i'E) ®e \<t>o)) € 
and poj = njpoHj- Consider an irrep j for which poj 7^ 
0. (At least one such j must exist, as the irreps span 
the Hilbert space.) Taking the partial trace over the D- 
fuU subsystem MjA (denoted Tr^^) and using the cyclic 
property of trace to eliminate T>jA gives 

'Tv,A{\i',E){i'jE\) = Tr,A(poj) , V \i,E) e Me . (25) 

Let \iIje) and \xe) be two orthogonal states in H^. Be- 
cause Me is a linear space, {\iPe) + \xe)) / G Me] thus, 

TrjA(poi) = TrjA(|V'jis)(V'jE|) , 

TrjA(Poj) = Trj-A(IXjE>(XiE|) , (26) 
TrjA(poj) = \^'[]a[{\^]e) + \X]e)){{'i1^je \ + (Xjb|)] • 
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These equations lead to the identity 

1:t,a{\^,e){Xje\) + Ty,A{\XjE){i',E\) = . (27) 

Repeating this argument for {\4'e) + Axe))/^ G H^; 
gives 

1:y,a{\^,e){Xje\) - TT,A{\XjE){i^,E\) = . (28) 

Combining these equations, we obtain 

Ti,A[\i'jE){XjE\) = Q if (V^bIxb) =0. (29) 

Let iCjs) be any state in MjB such that (CjS |poj lOs) 7^ 
(guaranteed to exist if p^j ^ 0). We define the relative 
state of ICjs) with respect to IV'j/b), denoted \i)jE.A), by 

\^,ea) = {Qb\^je)- (30) 
All such relative states are nonzero because 

{i^jE,A\'>i^jE,A) = TrjA((gB|i/'i£;)(^/'jis|CjB» 
^{QB\TrjA{\i^,E){i^jE\)\QB) 

= (OB|Trjvi(poj)lCii3) 

^0, (31) 

where the third equality uses Eq. H25() . The relative states 
of ICjs) with respect to a pair of orthogonal states, \'iPe) 
and \xe), in Me satisfy 

{XjE,AWjE,A) TrjVl((CjB|Xi£;)(V^j£;IOB)) 
= {QB\^'[]A{\'ipjE){XjE\)KjB) 

==0, (32) 

where the final step follows from Eq. H29|l . Thus, for any 
two orthogonal states \iI^)e and \x)e in H^, there exists 
a pair of non-zero orthogonal states in M.jA- The number 
of orthogonal states in WjA is upper bounded by its di- 
mension. Thus, the dimension of any completely private 
subsystem H^; cannot be greater than the dimension of 
the D-fuU subsystem M.jA for any j for which poj 7^ 0. 

It follows that the dimension of a completely private 
subsystem cannot be greater than the dimension of the 
largest D-fuU subsystem. Thus, an optimally efficient en- 
coding in achieved by using the largest D-full subsystem. 
□ 



E. Optimally efficient quantum communication 
scheme for a private shared Cartesian frame 

We now use the group theoretical structure of the su- 
peroperator to determine the optimally efficient quan- 
tum communication scheme for a private shared Carte- 
sian frame and transmission of spin- 1/2 particles. The 
Hilbert space (C^)®^ of these N qubits carries a col- 
lective tensor representation R^^ of SU(2), by which a 
rotation G SU(2) acts identically on each of the N 



qubits. This Hilbert space also carries a representation 
Pn of the symmetric group Sn, which is the group of 
permutations of the N qubits. The action of these two 
groups commute, and Schur-Weyl duality [s^ states that 
the Hilbert space (C^)®^ carries a multiplicity- free direct 
sum of SU(2)x5Ar irreps, each of which can be labelled 
by the SU(2) total angular momentum quantum number 
J. For simplicity, we restrict N to be an even integer for 
the remainder of this paper. Then, 

N/2 

(C2)®^^0e,, (33) 

where Hj is the eigenspace of total angular momentum 
with eigenvalue j, and the group SU(2) xS'^r acts irre- 
ducibly on each eigenspace. 

Because the groups SU(2) and Sn commute, the 
Hilbert space can be further decomposed. Each subspace 
Hj in the direct sum can be factored into a tensor prod- 
uct Mj = (g) Hjp, such that SU(2) acts irreducibly 
on Hj/j and trivially on Hjp, and Sm acts irreducibly on 
Hjp and trivially on Hjjj. Thus, 

N/2 

(C2)«^ = 0H,^®H,p. (34) 

The dimension of H^p is 

djR = 2j + 1 , (35) 
and that of H^p is @ 

'^^^(A^/f-.)iv/2+7-Hr ^''^ 

If Alice prepares N qubits in a state p and sends them 
to Bob, an eavesdropper Eve who is uncorrelated with 
the private SRF will describe the state as mixed over all 
rotations Vl G SU(2). Thus, the superoperator acting 
on a general density operator p oi N qubits that describes 
the lack of knowledge of this private SRF is given by 

SNip) = J dn R{nf^pR\n)^^ . (37) 

The effect of this superoperator is best seen through use 
of the decomposition (|34|l of the Hilbert space. The sub- 
systems Mjp are D-free or noiseless subsystems jsj un- 
der the action of this superoperator; states encoded into 
these subsystems are completely protected from this de- 
coherence. In contrast, £n is completely depolarizing on 
each Hjp subsystem, and thus the Hjp are D-full sub- 
systems. For each j, the subsystems Hjp (g) Mjp form a 
D-fuU/D-free subsystem pair. 

The largest D-full subsystem occurs for jmax = N'/2 
and has dimension 2jmax + l = iV-|-l. This D-full subsys- 
tem defines the optimally efficient private quantum com- 
munication scheme (by Theorem 1). Thus, given a pri- 
vate Cartesian frame and the transmission of N qubits, 
Alice and Bob can privately communicate log(A^ -f- 1) 
qubits, or log(A^) qubits asymptotically. 
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F. Optimally efficient quantum communication 
scheme for a private shared reference ordering 

Note the duality of the rotation group and the sym- 
metric group in the system described above. One may 
ask why we consider a reference frame for the first group 
and not the second. In fact, we have impUcitly assumed a 
reference frame for the permutation group in the form of 
a shared reference ordering. The simplest way in which 
two parties can possess a shared reference ordering is if 
they agree on some labelling of the qubits, for instance, 
using their temporal order, and if the quantum channel 
preserves this labelling. The shared reference ordering 
that has been assumed up until now has been taken to be 
public (i.e., Eve shares it as well); however, one can also 
consider it to be private. Here, we consider the dual prob- 
lem to the one of the previous section: a public Cartesian 
frame and a private reference ordering. 

Note that sharing a private reference ordering is not 
equivalent to sharing a secret key. This inequivalence 
may seem surprising, because the most obvious way in 
which Alice and Bob may share a private reference or- 
dering is for them to agree on a secret permutation of 
N elements (Alice applies the permutation to the qubits 
prior to transmission and Bob applies it to the qubits af- 
ter receiving them). As there are A^! elements in ^jv, this 
secret permutation is equivalent to sharing log(A'^!) bits 
of secret key. Nonetheless, in general when Alice and Bob 
share a private reference ordering they need not share any 
secret key. For instance, suppose the channel that con- 
nects Alice and Bob implements some fixed permutation 
PC of the qubits, and that this permutation is unknown 
to both Alice and Bob. The shared reference ordering is 
provided to Alice and Bob in the form of two devices, one 
for each party. Alice's device applies some permutation 
PA to her qubits prior to transmission, and Bob's device 
applies some permutation pB upon receiving them. The 
devices are designed such that pb = ipcPA)~^, and thus 
Bob recovers the quantum state of the qubits prepared 
by Alice. Assuming that pc is equally likely to be any 
element of Sn, Alice has no knowledge of pb and Bob 
has no knowledge of pA- Therefore, they do not share 
a secret key. Note further that although Eve may have 
knowledge of pc (which she may acquire, for instance, by 
examining the channel), she has no knowledge ofpA, and 
assuming that pA is chosen uniformly among elements of 
Sn, Eve's description of the qubits is related to Alice's 
description by the supcropcrator 

where P{p) is the unitary operator corresponding to the 
permutation p of the qubits. 

When the P{p) are decomposed into irreps, Vn induces 
the decomposition of H specified in Eq. H34() , which is the 
same decomposition that was induced by S^. However, 
there is a difference: with respect to the superoperator 



Pn, the subsystems Hjp are D-full (because Sn acts ir- 
reducibly on these subsystems) and the subsystems Mjn 
are D-free (because Sn acts trivially on these). 

For large N, the largest Mjp occurs for j = jmax, 
the integer nearest to ^/N /2, and has dimension djp = 
0{2^/N) (meaning that d^p < c2^ /N for some con- 
stant c and for all values of N) as can be deduced from 
Eq. (|36|) . This D-full subsystem defines the optimally ef- 
ficient private quantum communication scheme. It allows 
for private communication of N — log2 N logical qubits 
asymptotically given N transmitted qubits. 

G. Optimally efficient scheme for a private shared 
Cartesian frame and reference ordering 

Another interesting case is the one where Alice and 
Bob possess both a private Cartesian frame as well as a 
private reference ordering. For transmission of N qubits 
in this situation. Eve's lack of knowledge about either 
reference is characterized by the superoperator £n ° Pn- 
Interestingly, this superoperator is not completely depo- 
larizing on the entire Hilbert space. Even without shar- 
ing either reference. Eve can still measure the total 
operator to acquire information about the preparation. 
However, the subspaces Mjp (g) Mjp for each j are D-full 
under the action of this superoperator. Thus, Alice and 
Bob can perform private quantum communication by en- 
coding into one of these spaces. The largest D-full sub- 
space occurs for j = jmax, the integer nearest to a/^V /2, 
and has dimension djpdjp — 0{2^ /y/N). Asymptoti- 
cally, this allows for A^ — i log2 N private logical qubits 
to be encoded in N transmitted qubits. 



H. The duality between cryptography and 
communication 

We have been concerned with determining how much 
quantum information, prepared relative to some RF, can 
be completely hidden from someone who does not share 
this RF. If this person is an eavesdropper, then this con- 
cealment can be very useful for cryptography, as we have 
shown. However, it can occur that someone with whom 
one wants to communicate does not share the RF, for 
whatever reason. In this case, one is interested in the 
opposite problem, namely, how much quantum informa- 
tion can be made completely accessible to someone who 
docs not share the RF. This amount is determined by 
the largest D-frce subsystem, as was shown in @. The 
following dichotomy arises: information encoded in a D- 
fuU subsystem is hidden from someone lacking the RF, 
while information encoded in a D-free subsystem is still 
accessible to someone lacking the RF. The implications 
for the case we are considering can be summarized as 
follows. From the perspective of someone who lacks the 
SU(2) SRF, the Mjr are D-full and the W-jp are D-free; 
from the perspective of someone who lacks the Sn SRF, 
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it is the Mjp that arc D-fuU and the Mjn that are D-free. 
Thus, the number of logical qubits that can be trans- 
mitted privately given a private SU(2) SRF is equal to 
the number of logical qubits that can be communicated 
to a receiver that lacks the Sn SRF, and similarly with 
SU(2) and Sn reversed. What is bad for private quantum 
communication using a private SRF is good for quantum 
communication in the absence of an SRF. 



IV. PRIVATE CLASSICAL COMMUNICATION 

We now consider the private communication of clas- 
sical information through a quantum channel using the 
resource of a private SRF. We provide upper bounds on 
the efficiency of such schemes (maximum number of pri- 
vate messages that can be sent), and present schemes 
for private SU(2) and/or Sn SRFs that asymptotically 
saturate these bounds. As it turns out, the optimally 
efficient schemes for private classical communication are 
more efficient than the optimally efficient private quan- 
tum schemes (comparing private c-bits directly with pri- 
vate qubits). 

Definition: A private classical communication 
scheme for a decohering superoperator £ . Such a scheme 
consists of a set {pi] of density operators on H prepared 
by Alice that are (i) orthogonal, so that Bob can dis- 
tinguish these classical messages with certainty, and (ii) 
satisfy 

£[Pi] = Po , V , (39) 

where po is some fixed state in H, ensuring that Eve 
cannot gain any information about these classical mes- 
sages. An optimally efficient private classical communi- 
cation scheme has the maximum number of elements in 
the set {pi}. 

It is clear that every private quantum communication 
scheme can be turned into a private classical communi- 
cation scheme by encoding the classical messages into an 
orthogonal set of quantum states within the D-fuU sub- 
system employed by the latter. However, we now show 
that for the group-averaging superoperators, there ex- 
ist private classical communication schemes that perform 
much better. As with our three qubit example given in 
Section (nj the key to finding efficient private classical 
communication schemes is to encode into states that are 
entangled between D-fuU and D-free subsystems and span 
many irreps. 

A. An illustrative example 

Consider the following illustrative example. Let H be a 
Hilbert space. Let £ be a superoperator acting on states 
of this space such that, under a decomposition of H as 

A 

H = 0H„i®H„2, (40) 

a=l 



the subsystems Mai ® are D-full/D-free subsystem 
pairs under the action of £. For our example, we enforce 
the additional (and atypical) constraint that 

dim Hal = dimHa2 = d , (41) 

for some integer d independent of a. Thus, all of the D- 
fuU subsystems Hai and D-free subsystems EIa2 are of the 
same dimension, and the dimension of the total Hilbert 
space EI is Ad^ . 

If Eve's lack of correlations is described by the su- 
peroperator then a simple private classical commu- 
nication scheme can be constructed as follows. For a 
fixed arbitrary a, choose a set of d orthogonal states 
{|a, /c = 1, . . . , d} spanning the D-fuU subsystem Hqi, 
and an arbitrary fixed state |a, 0)2 S IH[a2- Then d classi- 
cal messages can be encoded into the d orthogonal states 
|a, k)i®\a, 0). All of these states map to the same density 
operator ^-^ai ® |a, 0)2(0, 0| under the action of £. 

However, a more efficient scheme can be constructed 
using entangled states in Hai ® Ha2, as follows. 

Let {|a,fc)i,fc = l,...,(i} be a basis for Hai, and 
{|a, A:')2,fc' = l,...,c?} be a basis for Ha2. The states 



\^aim) = exp(27rifcm/d)|a, fc)i|a, fc-|-Z)2 , (42) 

for l^m = 1, . . . , d are an orthogonal basis of maxi- 
mally entangled states in Hai <8) Ha2- Using the fact that 
the maximally entangled states \'4'aim) possess maximally 
mixed reduced density operators Trai(|?/'a/m)('0a;m|) = 
^/q2 , it follows that all such maximally entangled states 
map under £ to the state 

£{\i^alm){'^ahn\) = J^al ® 2^a2 , (43) 

for all /, m. Thus, one can encode d^ messages into en- 
tangled states of this form. 

Finally, we present an optimally efficient scheme which 
performs even better. Again, we define the entangled 
states \ipaim) for every a = 1, . . . , A as in Eq. H42() : these 
states form an orthogonal basis for the entire Hilbert 
space H. We then construct the Fourier transform states 
over the index a 

A 

|0/./m) = X] cxp(27ripa/A)|V'a/m) , (44) 

a=l 

for /i = 1, . . . , A. These states are also orthogonal: 

(<^^/m|0A''''m') = Su'5.,nm'Sfj.f_c' , (45) 

and each has the same and equal support on each of the 
subspaces Hai (8)Ha2. It is easily shown that they all map 
under the action of £ to the completely mixed operator 
on H; that is, 

£i\(f>f^im){4'f,hn\) = , \fl,m,p,. (46) 
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Thus, these orthogonal states define a private classical 
communication scheme. We note that there are A(P = 
dim 11 such states; therefore by Holcvo's theorem this 
scheme is optimally efficient. 

The difficulty with generalizing this scheme to typical 
group-averaging superoperators is that the induced ten- 
sor product structure of D-fuU and D-free subsystems for 
a given irrcp typically do not have equal dimensions, and 
these change as we vary over irreps. Below, we formulate 
and prove several theorems that allow us to place up- 
per bounds on the number of private classical messages, 
and to construct asymptotically-optimal schemes for pri- 
vate classical communication using private SU(2) and Sn 
SRFs. 



B. A single D-full/D-free subsystem pair 

Consider a decohering superoperator of the form Vja (8i 
TjB defined on ®Mb- This superoperator takes any 
state pAB on (8) to j^^a ® Ti a{pab)- We there- 
fore have a single D-full/D-free subsystem pair. We now 
prove a lemma for the optimally efficient private classical 
communication scheme in this case. 

Lemma 1: Consider a Hilbert space Ma (g) Hb, where 
Ma (Mb) has dimensionality dA (rfs). Let {pi} be a pri- 
vate classical communication scheme for the superopera- 
tor DjA^ljB- The maximum number of private classical 
messages (i.e., the maximum cardinality of the set {pi}) 
is M = dA ■ minjdyi, d^}- 

Proof: We consider two separate cases for the dimen- 
sions of the D-fuU and D-free subsystems. Each proof 
gives a construction for an optimally efficient private clas- 
sical communication scheme. Let {|fc)A} and {|fc)_B} be 
an orthonormal basis for and Mb , respectively. 

Case 1: dA> dB- The dA ■ dB orthogonal maximally- 
entangled states 

^ d.B 

IV'toi) = -=y^exp{27rikm/dB)\k + l)A\k)B, (47) 

where I ~ 1, . . . , and m = 1, . • . , rfs, satisfy Vja ® 
I]B{\ipi7n){il^im\) = ijlA®-^lB- Thus, this sct of statcs 
forms a private classical communication scheme. Because 
dA - dB is the dimension of Ha (8) Mb, there cannot exist 
a larger set of orthogonal states on this space, and thus 
this scheme is optimally efficient. 

Case 2: dA < dB- The d\ orthogonal maximally- 
entangled states 

^ dA 

IV';™) = ^= V exp{27rikm/dA)\k + l)A\k)B , (48) 

where /, to = 1, . . . , d^, satisfy VjA ®'IjB{\ipim){'4^im\) = 
-^Ia® ub, with 

1 

'^B = -^Y.\^)B{k\. (49) 



Thus, this set of states forms a private classical commu- 
nication scheme. 

This set of states has cardinality less than the dimen- 
sion of the joint Hilbert space; however, as we now show, 
the scheme is optimally efficient. First, consider sets of 
pure states. Every such state must have the same re- 
duced density operator on Mb, which we denote by ub- 
For a pure state, the rank of the reduced density op- 
erators on A and B must be equal, and because the 
former is bounded above by dA, the latter must be as 
well. Thus, we can limit our consideration to the sub- 
space C Mb spanned by the support of ctb, whose 
dimension is bounded above by dA- But this is just Case 
1 applied to Ma ® Hg, for which d\ is the maximum 
number of private messages. 

It remains to be shown that making use of a set of 
mixed states does not allow for a better scheme. Imagine 
a set {pi} of mixed states on Ma <E) Mb, containing M 
elements. Each pi must have the same reduced density 
operator on Mb, which we denote by cts. We denote the 
rank of ctb by r. Expressing each pi as an eigendecom- 
position, we have 

Li 

P^ = Y.Pi\^l'^)AB{i^l'^\, (50) 
1=1 

where {|V'/*'')a_b|^ = 1, • ■ • , ^i} are Li pure states on Ma(E> 
Mb- Each of these pure states has a reduced density 
matrix al2 = TrAdV'f '')AB(^/'f |) with rank r['^ < d^. 
For each z, a convex sum over I of the ct;^^^ must yield 

CTfi. It follows that '^J'' — '^i which implies that 

for all i, LidA > r- However, if all pi are orthogonal, 
they must possess orthogonal supports, and these will 
therefore span a space of dimension J2iLi ^i- This space 
is contained in Ma ® Hg-* (where H^-* C Mb is the r- 
dimensional space spanned by the support of ctb) and 
thus X]i=i — ^Af- Combining these inequalities yields 
M < d\- 

The set of statcs in Eq. (|48() consists of M = d\ ele- 
ments, therefore the scheme involving these states is op- 
timally efficient. □ 



C. A general group-averaging superoperator 

In the previous section we considered communication 
schemes using states that are confined to a single D- 
fuU/D-free subsystem pair. The most general scheme, 
however, makes use of states that span many such pairs. 
We must therefore consider the more general group- 
averaging superoperator 8 of Eq. H22(l . Let {pi] be a 
private classical communication scheme for this superop- 
erator, satisfying £{pi) = po for all pi- We now prove a 
lemma which bounds the cardinality of {pi}- 

Lemma 2: An upper bound on the number of states 
on EI in a private classical communication scheme for £ 



11 



is M = Mj , where Mj is the maximum number of 
states on Mj in a private classical communication scheme 
for VjA ®1jB- 

Proof: By assumption, 

£{Pi)=Po, (51) 

for all i. Projecting both sides of this equation onto an 
irrcp j, we obtain 

{VjA ® x,B)(njP,n,) = UjPqUj , (52) 

for all i. By Lemma 1, there are at most Mj orthog- 
onal states that arc mapped by "DjA (81 X/s to the same 
density operator. Therefore the supports of {IljPillj, i = 
1,2, . . .} must lie in a subspace of Mj with dimension not 
greater than Mj. 

The set of states {pi} must therefore have support on 
a subspace with dimension M = J^j ■ The cardinal- 
ity of the set of orthogonal states {pi} forming a pri- 
vate communication scheme is therefore upper-bounded 
hy M = J2^M,. a 

Thus, we have the following theorem: 

Theorem 2: In a private classical communication 
scheme for a group-averaging superoperator the num- 
ber M of private classical messages satisfies 

M <^ djA ■ mm{djA,djB} , (53) 

3 

where the djA [djB) are the dimensions of the D-fuU (D- 
free) subsystems defined by E. 

The proof is immediate from the preceding Lemmas. 

Given that our theorem yields only an upper bound 
on the number of private classical messages that can be 
sent, the question of exactly how many private classical 
messages can be achieved remains open. As the example 
provided in Eq. of section III Bl illustrates, the opti- 
mally efficient scheme is likely to make use of states that 
span irreps possessing unequal dimensions. 

D. Private classical communication using a private 
Cartesian frame 

We now consider the specific case of a private Cartesian 
frame, and present a scheme for private classical commu- 
nication that is optimally efficient in the limit of large 
N. 

Consider the decomposition of the iV-qubit Hilbert 
space (C^)®^ into a direct sum of D-fuU/D-frce subsys- 
tem pairs as in Eq. (|34|l . First, wc note, from Eq. H35() 
and H3()|l . that for all j strictly less than the maximum 
value N /2, the D-free subsystem Wjp is always of greater 
or equal dimension than the D-fuU subsystem Hj/j. Thus, 
we will employ irreps up to, but not including, j = N/2. 
Let jmin < N/2 be some fixed irrep. We now construct 
orthogonal entangled states for every irrep in the range 
jmin < j < N/2 as follows. For convenience, we denote 



the dimension of the D-fuU subsystem of the jmin irrep by 
d, that is, d = 2ji„in + l- Choose a set of orthogonal states 
{| j, s)fl, s = 1, . . . , rf} for Hjfl and a corresponding set of 
orthogonal states {|j, s')p,s' = l,...,d} for H^-p; note 
that such sets always exist because dimHjp = 2j + 1 > d 
for all j in the range jmin < j < N /2. For each irrcp in 
this range, a set of orthogonal entangled states are 
then given by 

1 

I^Ajfc;) = — Vcxp(27risA:/d)|j, s)p|j, s + l)p. (54) 

We wish to construct Fourier transformed states over j 
with equal weight in each irrep. Thus, we define 

jv/2-1 

|0Mfc/)= cxp(2mAij/(Ar/2-jmin))|V^jfei). (55) 

J=imin 

These states are all orthogonal, and all map to the same 
density matrix under the superoperator Ej^. The range 
of both i and I \s [1, . . . ^d — 2 jmin + !)■ and the range of 
/i is (1, . . . , N /2 — jmin); thus, thcrc are a total of 

M = {N/2 - Jmi„)(2jmin + 1)' (56) 

distinct states. To maximize this number asymptotically, 
we choose j = jmin, the integer nearest to -/V/3; this 
choice results in 0{N^) distinct states. Thus, asymptot- 
ically, this scheme allows for 3 log2 N private classical bits 
to be communicated using TV transmitted qubits, which 
saturates the upper bound given by Theorem 2. 

E. Private classical communication using a private 
reference ordering 

As a second example of private classical communica- 
tion, we consider the case where the private SRF is a pri- 
vate reference ordering. As discussed in section Ull l*'! in 
this case the superoperator is Vn (defined in Eq. 
and the Mjp are D-fuU subsystems while the Hjp are 
D-free subsystems. We consider only the limit of large 
N. In this case, the upper bound on the number of 
messages is simply 2^, the dimensionality of the entire 
Hilbert space. This bound is saturated asymptotically by 
a scheme similar to the one used in the previous section. 
For j < N/2, we have djp > djp, so that Case 1 of the 
proof of Lemma 1 applies and we can define djpdjp en- 
tangled states within the j irrep (using Eq. (|47|l ) which 
cannot be distinguished by Eve. For every j value in a 
window of approximate width ^/N centered at the inte- 
ger nearest ^/N, we have in the asymptotic limit that 
djp = 0{VW) and djP = 0{2^/N) (using Eqs. ^ 
and (|36() and Stirling's formula). Thus, in each such ir- 
rep, one can find Mj = 0(2^/V]V) orthogonal states 
that cannot be distinguished by Eve. We can therefore 
Fourier transform these states across the ^/N irreps, us- 
ing the construction of Eq. (|44|l . The end result is a set 
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TABLE I: Asymptotic capacity for private quantum and clas- 
sical communication for transmitted qubits and various 
private shared reference frames. 



Nature of the private SRF 


Private quantum 
capacity (qubits) 


Private classical 
capacity (c-bits) 


Private Cartesian frame 
(Private SU{2) SRF) 


log2(Af) 


31og2(iV) 


Private reference ordering 
(Private Sn SRF) 


N-log^iN) 


N 


Both private 
(Private SU(2) & Sn SRF) 


TV - ilog2(Af) 


N 



of states that cannot be distinguished by Eve, the car- 
dinality of which is M = 0{2^). Thus, asymptotically, 
one achieves N private c-bits using this scheme. 

F. Private classical communication using a private 
Cartesian frame and reference ordering 

If Alice and Bob possess both a private Cartesian 
frame and a private reference ordering of the transmitted 
qubits, then they can encode at least as many classical 
messages as they could with just a private reference or- 
dering. Thus, asymptotically, they can achieve N private 
c-bits in this case as well. One cannot achieve any more 
than this, because Holevo's theorem ensures that using 

transmitted qubits at most N c-bits, whether private 
or public, can be communicated. 

V. DISCUSSION 

In this paper, we have demonstrated that private 
shared reference frames are a resource of private correla- 
tions which can be used for cryptography. We have pre- 
sented optimally efficient schemes for private quantum 
and classical communication using an insecure quantum 
channel for spin-1/2 systems and a shared Cartesian ref- 
erence frame and/or a shared reference ordering of the 
systems. The results are summarized in Table 

We note that our private classical schemes using a pri- 
vate SRF are similar in some ways to private-key cryptog- 
raphy, specifically, the Vernam cipher (one-time pad) [l| . 
For example, the secret key in the Vernam cipher can be 
used only once to ensure perfect security. Similarly, for 
our classical schemes, only a single plain-text (classical or 
quantum) can be encoded using a single private SRF. If 
the same private SRF is used to encode two plain-texts, 
then the relation that holds between the two cipher-texts 
carries information about the plain-texts, and because it 
is possible to learn about this relation without making 
use of the SRF, Eve can obtain this information. This 
fact is clear from the example of a classical communica- 
tion scheme by transmission of a classical pencil or gy- 
roscope, considered in the introduction. Although Eve 



cannot determine the Eulcr angles of the pencils rela- 
tive to the shared Cartesian frame, she can measure the 
angular separation of the two pencils. 

It is also useful to consider the differences between us- 
ing private shared reference frames and a secret key for 
private communication. One clear difference is that a se- 
cret key may be subdivided into a number of smaller se- 
cret keys, and each of these can be used independently of 
one another. (By "independently" , we mean that one can 
encode a plain-text using the first key prior to knowing 
the identity of the plain-text that will be encoded using 
the second key). This feature does not hold when imple- 
menting private communication using a private SRF. 

Although a private SRF is not equivalent to secret clas- 
sical key or entanglement, the former can yield the lat- 
ter when supplemented by the use of a public quantum 
channel. Specifically, one can distribute a secret classical 
key by implementing the private classical communication 
scheme outlined in this paper with the key as plain-text. 
Similarly, one can establish entanglement between two 
parties by implementing a private quantum communi- 
cation scheme where the subsystem encoding the quan- 
tum plain-text is entangled with systems that the sender 
keeps. Note that a private SRF also yields secret classical 
key if it is supplemented by a public SRF. For instance, 
perfect private and public shared Cartesian frames yield 
an infinite amount of secret key (in practice, the size of 
the key is limited by the size of the physical system that 
defines the Cartesian frame). 

Another question of interest is how a private SRF is 
established. Clearly, a public Cartesian frame together 
with an infinite classical key yields a perfect private 
Cartesian frame (the key defines the Eulcr angles of the 
private frame relative to the public frame). Shared en- 
tanglement of a certain sort can also be consumed to 
align local RFs |3 |3^ |3^ . Another interesting possi- 
bility is to set up the SRF by transmitting systems from 
Alice to Bob in a way that is sensitive to eavesdropping. 
Whether an analogue of key distribution can be achieved 
in this context is an interesting question for future re- 
search. Another such question is whether one can recy- 
cle a private SRF by monitoring for eavesdropping, in 
the same manner that one can recycle classical key and 
entanglement nil. Finally, we note that we have consid- 
ered only classical reference frames. Preliminary research 
into the description and characterization of quantum ref- 
erence frames (c.f., j37., ^J) leaves open the possibility 
for their use as a shared private correlation. 

Although the relationship between secret k eys and en- 
tanglement has been analyzed in some detail |33 , the re- 
lationship between these and private SRFs still remains 
largely unexplored. Quantifying the power of private 
SRFs for encoding classical and quantum information is 
an important step in such an investigation. 

Note added in proof. Recent independent results 
have established the optimal schemes for transmitting 
an SU(2) reference frame ^3 ^'^'^ reference 
ordering [43 | through the transmission of quantum sys- 



13 



terns. The techniques used in these investigations are 
remarkably similar to those used to develop our optimal 
private classical communication schemes using a private 
shared RF. Specifically, the optimal 7V-qubit states used 
for transmitting a reference frame or reference ordering 
span many irreps and are entangled between D-fuU/D- 
frcc subsystem pairs within an irrep, as do the states used 
in our optimal private classical communication schemes. 
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